Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1341: Multiple Releases of Same Resource or Handle

Base Incomplete

The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.

More detail

Note that while the implementation for most (if not all) resource reservation allocations involve a unique identifier/pointer/symbolic reference, then if this identifier is reused, checking the identifier for resource closure may result in a false state of openness and closing of the wrong resource. For this reason, reuse of identifiers is discouraged.

How to prevent it (3 mitigations)

  1. Implementation

    Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.

  2. Implementation

    It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed. However, flag-tracking can increase code complexity and requires diligent compliance by the programmer.

  3. Implementation

    When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors. For other APIs, this can lead to application crashes or exceptions, which may still be preferable to corrupting an unintended resource such as memory or data.

Source: MITRE CWE-1341

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-6654

    Use-After-Free and Double-Free in IntoIter::drop when element drop panics

    Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

    Mozilla thin-vec rust-thin-vec thin-vec Debian Ubuntu crates.io
  • Medium 6.3
    CVE-2026-4039

    OpenClaw Skill Env applySkillConfigenvOverrides code injection

    A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely.…

    openclaw npm